Skip to content

Commit b610633

Browse files
kwwallkwwall
authored
Pom updates to address issue ESAPI#847 (ESAPI#848)
* Close GitHub issue ESAPI#847. 1. Update pom to latest version of compatible dependencies and plugins. 2. Remove commons-io:commons-io:2.15.1 previously needed for convergence as Commons FileUpload no longer requires it and AntiSamy 1.7.5 now uses 2.15.1. So we no longer need to explicitly load it for convergence to succeed. * Minor documentation tweaks to esapi.tld.
1 parent cb3839f commit b610633

File tree

2 files changed

+24
-37
lines changed

2 files changed

+24
-37
lines changed

‎pom.xml

Lines changed: 20 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -134,9 +134,9 @@
134134
<version.findsecbugs>2.0.0-M3</version.findsecbugs>
135135
<version.fluido>2.0.0-M9</version.fluido>
136136
<version.powermock>2.0.9</version.powermock>
137-
<version.spotbugs>4.8.5</version.spotbugs>
138-
<version.spotbugs.maven>4.8.5.0</version.spotbugs.maven>
139-
<version.surefire>3.2.5</version.surefire>
137+
<version.spotbugs>4.8.6</version.spotbugs>
138+
<version.spotbugs.maven>4.8.6.2</version.spotbugs.maven>
139+
<version.surefire>3.3.0</version.surefire>
140140
<project.java.target>1.8</project.java.target>
141141
<!-- TODO: Be sure to update. Should be date of previous official release -->
142142
<!-- Exact date in the form 'yyyy-dd-yy 00:00:00' should be used. You can find the previous release date -->
@@ -233,7 +233,7 @@
233233
<dependency>
234234
<groupId>org.apache.commons</groupId>
235235
<artifactId>commons-collections4</artifactId>
236-
<version>4.5.0-M1</version>
236+
<version>4.5.0-M2</version>
237237
</dependency>
238238
<dependency>
239239
<groupId>org.apache-extras.beanshell</groupId>
@@ -243,7 +243,7 @@
243243
<dependency>
244244
<groupId>org.owasp.antisamy</groupId>
245245
<artifactId>antisamy</artifactId>
246-
<version>1.7.5</version>
246+
<version>1.7.6</version>
247247
<exclusions>
248248
<!-- excluded because we directly import newer version below. -->
249249
<exclusion>
@@ -274,21 +274,6 @@
274274
<version>1.4.01</version>
275275
</dependency>
276276

277-
<!--
278-
FORCE SPECIFIC VERSIONS OF TRANSITIVE DEPENDENCIES EXCLUDED ABOVE.
279-
This is to force patched versions of these libraries with known CVEs against them.
280-
-->
281-
<dependency>
282-
<!-- We include this, because Commons File Upload still includes an
283-
old one, but AntiSamy 1.7.4 includes a newer one (2.14.0), which causes the goal
284-
org.apache.maven.plugins:maven-enforcer-plugin:3.3.0:enforce to fail
285-
in DependencyConvergence.
286-
-->
287-
<groupId>commons-io</groupId>
288-
<artifactId>commons-io</artifactId>
289-
<version>2.15.1</version>
290-
</dependency>
291-
292277
<!-- SpotBugs dependencies -->
293278
<dependency>
294279
<groupId>com.github.spotbugs</groupId>
@@ -423,17 +408,17 @@
423408
<plugin>
424409
<groupId>org.apache.maven.plugins</groupId>
425410
<artifactId>maven-dependency-plugin</artifactId>
426-
<version>3.6.1</version>
411+
<version>3.7.1</version>
427412
</plugin>
428413
<plugin>
429414
<groupId>org.apache.maven.plugins</groupId>
430415
<artifactId>maven-release-plugin</artifactId>
431-
<version>3.0.1</version>
416+
<version>3.1.0</version>
432417
</plugin>
433418
<plugin>
434419
<groupId>org.codehaus.mojo</groupId>
435420
<artifactId>versions-maven-plugin</artifactId>
436-
<version>2.16.2</version>
421+
<version>2.17.0</version>
437422
<configuration>
438423
<rulesUri>file:${project.basedir}/versionRuleset.xml</rulesUri>
439424
</configuration>
@@ -488,7 +473,7 @@
488473
<plugin>
489474
<groupId>org.apache.maven.plugins</groupId>
490475
<artifactId>maven-clean-plugin</artifactId>
491-
<version>3.3.2</version>
476+
<version>3.4.0</version>
492477
</plugin>
493478

494479
<plugin>
@@ -543,7 +528,7 @@
543528
<plugin>
544529
<groupId>org.apache.maven.plugins</groupId>
545530
<artifactId>maven-enforcer-plugin</artifactId>
546-
<version>3.4.1</version>
531+
<version>3.5.0</version>
547532
<dependencies>
548533
<dependency>
549534
<groupId>org.codehaus.mojo</groupId>
@@ -553,7 +538,7 @@
553538
<dependency>
554539
<groupId>org.codehaus.mojo</groupId>
555540
<artifactId>animal-sniffer-enforcer-rule</artifactId>
556-
<version>1.23</version>
541+
<version>1.24</version>
557542
</dependency>
558543
</dependencies>
559544

@@ -636,7 +621,7 @@
636621
<plugin>
637622
<groupId>org.apache.maven.plugins</groupId>
638623
<artifactId>maven-jar-plugin</artifactId>
639-
<version>3.4.1</version>
624+
<version>3.4.2</version>
640625
<configuration>
641626
<archive>
642627
<manifest>
@@ -648,9 +633,9 @@
648633
</plugin>
649634

650635
<plugin>
651-
<groupId>org.apache.maven.plugins</groupId>
652-
<artifactId>maven-javadoc-plugin</artifactId>
653-
<version>3.6.3</version>
636+
<groupId>org.apache.maven.plugins</groupId>
637+
<artifactId>maven-javadoc-plugin</artifactId>
638+
<version>3.7.0</version>
654639
<configuration>
655640
<source>8</source>
656641
<doclint>none</doclint>
@@ -668,19 +653,19 @@
668653
<plugin>
669654
<groupId>org.apache.maven.plugins</groupId>
670655
<artifactId>maven-jxr-plugin</artifactId>
671-
<version>3.3.2</version>
656+
<version>3.4.0</version>
672657
</plugin>
673658

674659
<plugin>
675660
<groupId>org.apache.maven.plugins</groupId>
676661
<artifactId>maven-pmd-plugin</artifactId>
677-
<version>3.22.0</version>
662+
<version>3.23.0</version>
678663
</plugin>
679664

680665
<plugin>
681666
<groupId>org.apache.maven.plugins</groupId>
682667
<artifactId>maven-project-info-reports-plugin</artifactId>
683-
<version>3.5.0</version>
668+
<version>3.6.1</version>
684669
</plugin>
685670

686671
<plugin>
@@ -694,7 +679,7 @@
694679
The skin is referenced in src/site/site.xml. -->
695680
<groupId>org.apache.maven.plugins</groupId>
696681
<artifactId>maven-site-plugin</artifactId>
697-
<version>4.0.0-M14</version>
682+
<version>4.0.0-M15</version>
698683
<dependencies>
699684
<dependency>
700685
<groupId>org.apache.maven.skins</groupId>
@@ -755,7 +740,7 @@
755740
<plugin>
756741
<groupId>org.owasp</groupId>
757742
<artifactId>dependency-check-maven</artifactId>
758-
<version>9.2.0</version>
743+
<version>10.0.2</version>
759744
<configuration>
760745
<nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
761746
<failBuildOnCVSS>1.0</failBuildOnCVSS>

‎src/main/resources/META-INF/esapi.tld

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
~ Enterprise Security API (ESAPI) project. For details, please see
88
~ <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.
99
~
10-
~ Copyright (c) 2007 - The OWASP Foundation
10+
~ Copyright (c) 2007-2024 - The OWASP Foundation
1111
~
1212
~ The ESAPI is published by OWASP under the BSD license. You should read and accept the
1313
~ LICENSE before you use, modify, and/or redistribute this software.
@@ -22,14 +22,16 @@
2222
xsi:schemaLocation="
2323
http://java.sun.com/xml/ns/j2ee
2424
http://java.sun.com/xml/ns/j2ee/web-jsptaglibrary_2_0.xsd"
25-
version="2.0">
25+
version="2.x">
2626
<description>
2727
OWASP Enterprise Security API (ESAPI) provides
2828
a JSP Tag Library that supplies easy access to
2929
encoding functionality in the form of JSP Tags and EL
3030
functions. These can be used to properly escape user
3131
supplied data at display time so that it cannot be used
3232
in injection attacks like Cross Site Scripting (XSS).
33+
This tag library applies to all of ESAPI 2.x versions. Its
34+
interface hasn't changed since 2.0.
3335
</description>
3436
<display-name>OWASP ESAPI</display-name>
3537
<tlib-version>2.0</tlib-version>

0 commit comments

Comments
 (0)